jochen
d0a3784be2
lib (bind-mounted into the container at /var/lib/onlyoffice) was 0711 so nginx inside the container could reach App_Data/cache, and the module root above it stayed 0711 too, so any account on the machine could walk through the root into lib's 0755 directories and 0644 files to read converted documents. The container never passes through the root — only the converter process does, to read jwt.secret and broker-converter.secret — so the root is now 0710, owned by the converter account: only that account and root pass through it. lib stays 0711 (1837/AC3).
only-office
The only-office module of the mesh catalogue: runs the container image onlyoffice/documentserver.
Files it does not know
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
${dir:state}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:logs}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:data}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:lib}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:db}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:rabbitmq}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:redis}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:fonts}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).